Pinnacle Cart Index.PHP Cross-Site Scripting Vulnerability
BID:13138
Info
Pinnacle Cart Index.PHP Cross-Site Scripting Vulnerability
| Bugtraq ID: | 13138 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-1130 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 12 2005 12:00AM |
| Updated: | Feb 22 2007 03:06AM |
| Credit: | SmOk3 [[email protected]] is credited with the discovery of this vulnerability. |
| Vulnerable: |
Pinnacle Cart Pinnacle Cart |
| Not Vulnerable: |
Pinnacle Cart Pinnacle Cart 3.5 |
Discussion
Pinnacle Cart Index.PHP Cross-Site Scripting Vulnerability
Pinnacle Cart is affected by a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Pinnacle Cart is affected by a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Exploit / POC
Pinnacle Cart Index.PHP Cross-Site Scripting Vulnerability
No exploit is required.
The following proof of concept is available:
http://www.example.com/index.php?p=catalog&parent=12&pg="><script>alert(document.domain);</script>
No exploit is required.
The following proof of concept is available:
http://www.example.com/index.php?p=catalog&parent=12&pg="><script>alert(document.domain);</script>
Solution / Fix
Pinnacle Cart Index.PHP Cross-Site Scripting Vulnerability
Solution:
The vendor has released version 3.5 to address this issue; please contact the vendor for information regarding product upgrades.
Solution:
The vendor has released version 3.5 to address this issue; please contact the vendor for information regarding product upgrades.
References
Pinnacle Cart Index.PHP Cross-Site Scripting Vulnerability
References:
References:
- Pinnacle Cart Homepage (Pinnacle Cart)